arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs

arXiv cs.AI: Signed but Not Safe: Requirement Integrity in Multi-Agent LLM Handoffs

The authors of “Signed but Not Safe” study a specific risk in multi-agent AI systems: when one agent passes work to another, requirements can be summarized away, altered or ignored. Their handoff records each requirement as a verbatim quote plus a checkable predicate, then uses HMAC-SHA256 to sign the record and deterministic code to verify the merged decision. In synthetic, exactly scorable tasks with Qwen3-8B, the authors report that signed manifests reduced unsafe commits under attack from 69.4% to 9.0%, without a net loss of conformant commits compared with structured handoffs. But the signature only protects the manifest after it is created. An adversarial line before signing increased violations, and the signature authenticated the corrupted manifest. The authors identify requirement extraction—not just transmission—as the trust boundary: a secure handoff cannot repair a requirement that was already captured incorrectly. They also report that a deterministic verifier caught more violating decisions than an LLM checker, with fewer false alarms in their study. These results describe the paper’s tested tasks and models; they do not establish performance in other settings.

Publication: 1bc017ca-833a-4659-8b60-9275114c2a86

attribution — pass: The reading attributes the findings to the authors of the arXiv paper and keeps them as reported results, not established facts. Labelling the source arXiv cs.AI matches the publisher field; the paper is primarily cs.CR but cross-listed in cs.AI.

Authors:Xiaobo Chen, Genliang Zhu, Ziyuan Wang, Chu Wang

summary — uncertain: The reading tracks the abstract and keeps its sharp turn that signing protects transit, not extraction. But the headline metric, unsafe versus conformant commits, is never put in plain language, so a general reader may not know a commit is the merger's final accepted decision. Manifest and HMAC-SHA256 are also unexplained; tooltips may cover them, but the central result should be readable directly. Smallest repair: one clause saying a commit is the merged decision the system accepts, and that unsafe means it violates a requirement.

signed manifests cut unsafe commits under attack from 69.4% to 9.0%

date — pass: originalPublished 2026-11-05 matches the v1 submission date on arXiv. The later feed date of 2026-11-06 was correctly not used.

[Submitted on 5 Nov 2026]

support — pass: Every claim is backed by verbatim abstract text: the handoff risk, the Qwen3-8B comparison, the drop from 69.4% to 9.0%, and the deterministic-versus-LLM checker results. The line that a secure handoff cannot repair a badly captured requirement is a fair restatement of the authors' residual-risk finding. The limitations and the question stay within the evidence and avoid generalizing beyond the tested tasks.

An oracle manifest removed all remaining unsafe commits: the residual risk comes from extraction errors made before signing.

media — pass: The selected media is the verified direct link to the original arXiv abstract page. That is the most direct way for a reader to reach the actual source.